PT0-002 Engagement Management Practice Question
A penetration tester is conducting a wireless network assessment for a client. The client has provided a list of authorized SSIDs and MAC addresses of access points. During the assessment, the tester discovers a rogue access point that is not on the authorized list and is broadcasting a similar SSID to the corporate network. Which TWO of the following actions should the tester take? (Choose two.)
⚠ Common exam trap
The trap here is taking active countermeasures like deauthenticating clients or launching a DoS attack, which are usually out of scope and could cause disruption.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Notify the client's point of contact immediately about the rogue access point
When a rogue access point is discovered, the tester should document its details and notify the client's point of contact immediately. These actions provide the client with the necessary information to investigate and remove the rogue device, while adhering to the rules of engagement. Active countermeasures like deauthentication or DoS attacks should not be taken unless explicitly authorized. Connecting to the rogue AP could be risky and is generally not recommended.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
Notify the client's point of contact immediately about the rogue access point
Why this is correct
Notifying the client's point of contact immediately is critical because a rogue access point could indicate a security breach or unauthorized network. The client needs to know so they can investigate and take action. This communication should follow the agreed incident response procedure. It ensures the client is aware and can mitigate any potential risks. The tester should not attempt to remediate without authorization.
- ✗
Immediately deauthenticate all clients connected to the rogue access point
Why it's wrong here
Deauthenticating clients from the rogue access point could disrupt legitimate users and may not be authorized by the client. The tester should first report the finding to the client's point of contact and follow the incident response plan. Active countermeasures like deauthentication should only be taken if explicitly authorized in the rules of engagement. The tester's role is to assess and report, not to remediate without permission.
- ✓
Document the rogue access point's details, including MAC address, channel, and signal strength
Why this is correct
Documenting the rogue access point's details is essential for the report and for the client to locate and remove it. The tester should record the MAC address, channel, signal strength, and any other relevant information. This documentation provides evidence of the finding and helps the client take appropriate action. It is a standard part of the assessment and does not disrupt the network.
- ✗
Attempt to connect to the rogue access point to determine its security configuration
Why it's wrong here
Connecting to the rogue access point could be dangerous and may violate the rules of engagement. The rogue access point might be malicious, and connecting to it could compromise the tester's system or lead to legal issues. The tester should not interact with unauthorized devices unless explicitly permitted. Instead, the tester should document and report the finding.
- ✗
Perform a denial-of-service attack to disable the rogue access point
Why it's wrong here
Performing a DoS attack on the rogue access point is not authorized and could disrupt legitimate users or cause unintended consequences. The tester should not take active countermeasures unless explicitly allowed in the rules of engagement. The proper actions are to document the finding and notify the client. The client is responsible for remediation.
Quick reference
Access Control Model Comparison
| Model | Acronym | Who Controls Access? | Best For |
|---|---|---|---|
| Discretionary Access Control | DAC | Resource owner | Small teams, file shares |
| Mandatory Access Control | MAC | System / security labels | Classified govt / military |
| Role-Based Access Control | RBAC | Administrator (via roles) | Enterprise environments |
| Attribute-Based Access Control | ABAC | Policy engine (user + resource attributes) | Fine-grained, dynamic policies |
| Rule-Based Access Control | RuBAC | System rules / ACLs | Firewall rules, network ACLs |
Go deeper
Related to this question
About these practice questions
This PT0-003 question is part of Courseiva's 777-question bank — original exam-style content with full explanations and wrong-answer analysis, never real exam questions or exam dumps. Learn why practice questions differ from exam dumps →
JA
Written and reviewed by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
Last reviewed September 2026 · checked against the official CompTIA exam blueprint
This PT0-003 practice question is part of Courseiva's free CompTIA certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the PT0-003 exam.